demo: working github demo

architecture/dependency-graph.json

@@ -3206,6 +3206,20 @@
       "default_features": true,
       "features": []
     },
+    {
+      "source": "auths-github-demo",
+      "source_layer": "demos",
+      "target": "base64ct",
+      "target_layer": null,
+      "scope": "external",
+      "kind": "normal",
+      "target_condition": null,
+      "optional": false,
+      "default_features": false,
+      "features": [
+        "alloc"
+      ]
+    },
     {
       "source": "auths-github-demo",
       "source_layer": "demos",

bindings/customer-journey-matrix-v1.json

@@ -7,9 +7,9 @@
     "enforcement": "baseline",
     "baseline": {
       "typescriptEntryPoints": 8,
-      "typescriptPublicSymbols": 191,
+      "typescriptPublicSymbols": 203,
       "pythonModules": 8,
-      "pythonPublicSymbols": 169,
+      "pythonPublicSymbols": 180,
       "maintainedTypescriptRecipes": 5,
       "maintainedPythonRecipes": 5
     },
@@ -473,6 +473,54 @@
         "consumerRequiresRust": false
       }
     },
+    {
+      "id": "github-agent-one-issue-one-draft-pr",
+      "rust": "product/integrations/auths-github/src/service.rs",
+      "typescript": "bindings/typescript/test/unit/github-agent.test.js",
+      "python": "bindings/python/tests/test_github_agent.py",
+      "experience": {
+        "targetJourney": "delegate-one-bounded-github-issue-task-and-open-one-draft-pull-request",
+        "imports": [
+          "service"
+        ],
+        "securityNouns": [
+          "Authority",
+          "Action",
+          "Receipt"
+        ],
+        "domainConcepts": [
+          "GitHub issue",
+          "candidate bundle"
+        ],
+        "setupDecisions": [
+          "operator endpoint"
+        ],
+        "apiMechanics": [
+          "discover boundary",
+          "delegate",
+          "inspect candidate",
+          "execute",
+          "reconcile",
+          "verify receipts"
+        ],
+        "requiredApplicationComponents": [
+          "candidate bundle path",
+          "candidate revision",
+          "operator endpoint"
+        ],
+        "executableStatements": 20,
+        "applicationOrchestratedSecurityTransitions": 0,
+        "terminalOutcomes": [
+          "completed",
+          "denied",
+          "indeterminate",
+          "replayed",
+          "reconciled",
+          "verified"
+        ],
+        "consumerRequiresRust": false
+      }
+    },
     {
       "id": "installed-artifact-and-type-safety",
       "rust": "bindings/wasm/auths-proof-wasm/examples/generate-node-vectors.rs",

bindings/python/README.md

@@ -40,22 +40,28 @@ async with development.create_auths(
 ## Use a production runtime
 
 ```python
-from auths import create_auths
-from auths.profiles import github_issue_address
-
-auths = create_auths(
-    endpoint="https://auths.example.com",
-    identity=public_identity_bytes,
-    profile=github_issue_address(),
-)
-authority = await auths.create(authority_request_bytes)
-if authority.kind != "authority":
-    raise RuntimeError(authority.code)
-result = await auths.execute(authority, action_bytes)
-if result.kind == "recoverable":
-    await auths.resume(result.reference)
+from auths.service import GitHubAgentTask, create_github_agent_client
+
+auths = create_github_agent_client(endpoint="https://executor.example")
+boundary = await auths.boundary()
+task = await auths.delegate(GitHubAgentTask(
+    repository=boundary.repository,
+    issue_number=boundary.issue_number,
+    base_ref=boundary.base_ref,
+    base_revision=boundary.base_revision,
+    allowed_paths=boundary.allowed_paths,
+    protected_paths=boundary.protected_paths,
+    expires_in_seconds=boundary.maximum_expiry_seconds,
+    branch_budget=1,
+    draft_pull_request_budget=1,
+    agent_label="issue-agent",
+))
 ```
 
+Continue with a candidate bundle file using the maintained
+[GitHub quickstart](../../docs/product/PRODUCTION_SDK_QUICKSTART.md). No
+protocol bytes or GitHub credential enter application code.
+
 ## Public modules
 
 One wheel provides the same progressive topology as TypeScript:
@@ -65,6 +71,7 @@ One wheel provides the same progressive topology as TypeScript:
 | `auths` | create, delegate, execute, resume, product results and errors |
 | `auths.identity` | standalone identity decoding and authentication |
 | `auths.verify` | effect-free proof, decision and receipt verification |
+| `auths.service` | generic five-verb operator-runtime transport |
 | `auths.profiles` | qualified MCP, OpenTofu, PostgreSQL and GitHub effect domains |
 | `auths.integrations` | maintained compositions and mechanism adapters |
 | `auths.framework` | proven signer and atomic-reservation contracts |
@@ -94,11 +101,11 @@ idempotent and close owned signers and native sessions.
 
 ## Production boundary
 
-The development composition uses ephemeral keys and in-memory state. The root
-production client talks to an HTTPS operator runtime through a bounded,
-Rust-owned binary contract. Provider credentials remain behind the profile
-gateway and are acquired only after Auths has authorized and durably reserved
-the exact action.
+The development composition uses ephemeral keys and in-memory state. The
+generic remote client and the profile-specific GitHub launch path live at
+`auths.service`. Provider credentials remain behind
+the Rust profile gateway and are acquired only after Auths has authorized and
+durably claimed the exact action.
 
 Supported Python, platform, ABI and semantic-subject claims are recorded in
 `sdk-runtime-contract.json`. Public API and wheel-content snapshots reject

bindings/python/api/public-api.txt

@@ -83,6 +83,16 @@ verify_receipt
 AuthsError
 AuthsErrorCode
 EffectState
+GitHubAgentBoundary
+GitHubAgentClient
+GitHubAgentError
+GitHubAgentOutcome
+GitHubAgentSession
+GitHubAgentTask
+GitHubCandidateFile
+GitHubCandidateInspection
+GitHubDenialFixture
+GitHubVerifiedReceipts
 NextCall
 ProductVerb
 RecommendedAction
@@ -103,6 +113,7 @@ ServiceTransportRequest
 ServiceTransportResponse
 ServiceVerificationResult
 ServiceVerified
+create_github_agent_client
 create_service_client
 import_authority
 

bindings/python/external/full_workflow_consumer.py

@@ -6,10 +6,113 @@
 
 from auths.integrations import development
 from auths.profiles import mcp
+from auths.service import GitHubAgentTask, create_github_agent_client
 from auths.verify import verify_receipt
 
 
 async def run(_: Path) -> None:
+    github = create_github_agent_client(endpoint="https://operator.example")
+    responses = [
+        {
+            "schema": "auths-github-agent/v1",
+            "repository": "auths-dev/example",
+            "issue_number": 7,
+            "base_ref": "main",
+            "base_revision": "a" * 40,
+            "allowed_paths": ["src/**"],
+            "denied_paths": [".github/**"],
+            "budgets": {"branches": 1, "draft_pull_requests": 1},
+            "expiry": {"minimum_seconds": 60, "maximum_seconds": 900},
+            "agent_credential_present": False,
+        },
+        {
+            "schema": "auths-github-agent/v1",
+            "session_id": "1" * 32,
+            "workflow_id": "demo-" + "1" * 32,
+            "expires_at": 1_000,
+            "target_ref": "auths/issue-7-111111111111",
+            "agent_principal": "urn:auths:raw-key:agent",
+            "required_configuration": "2" * 64,
+            "executed_configuration": "2" * 64,
+        },
+        {
+            "schema": "auths-github-agent/v1",
+            "candidate": {
+                "status": "inspected",
+                "candidate_revision": "b" * 40,
+                "changed_paths": [{"path": "src/fix.py"}],
+                "direct_push": {"result": "refused-without-credential"},
+                "preview": {
+                    "code": "authorized",
+                    "credential_would_be_requested": True,
+                },
+            },
+        },
+        {
+            "schema": "auths-github-agent/v1",
+            "decision": {"class": "authorized", "code": "authorized"},
+            "execution": {
+                "branch_ref": "auths/issue-7-111111111111",
+                "pull_request_number": 8,
+                "pull_request_url": "https://github.com/auths-dev/example/pull/8",
+            },
+            "credential_requests": 2,
+            "mutations": 2,
+        },
+        {
+            "schema": "auths-github-agent/v1",
+            "workflow_id": "demo-" + "1" * 32,
+            "receipts": [{"type": "decision"}, {"type": "execution"}],
+        },
+        {
+            "schema": "auths-github-agent/v1",
+            "decision": {"class": "authorized", "code": "action-replay"},
+            "execution": {"replay": "original-receipt-returned"},
+            "credential_requests": 0,
+            "mutations": 0,
+        },
+    ]
+
+    async def github_boundary(_path: str, _body=None):
+        if not responses:
+            raise RuntimeError("installed GitHub client made an extra call")
+        return responses.pop(0)
+
+    github._call = github_boundary  # type: ignore[method-assign]
+    boundary = await github.boundary()
+    if boundary.branch_budget != 1 or boundary.agent_credential_present is not False:
+        raise RuntimeError("installed GitHub boundary widened")
+    github_session = await github.delegate(
+        GitHubAgentTask(
+            repository=boundary.repository,
+            issue_number=boundary.issue_number,
+            base_ref=boundary.base_ref,
+            base_revision=boundary.base_revision,
+            allowed_paths=boundary.allowed_paths,
+            protected_paths=boundary.protected_paths,
+            expires_in_seconds=boundary.maximum_expiry_seconds,
+            branch_budget=1,
+            draft_pull_request_budget=1,
+            agent_label="wheel-consumer",
+        )
+    )
+    inspected = await github.inspect_fixture(github_session, "exact")
+    completed = await github.execute(github_session)
+    verified = await github.verify_receipts(github_session)
+    replayed = await github.replay(github_session)
+    if (
+        inspected.kind != "inspected"
+        or completed.kind != "completed"
+        or verified.kind != "verified"
+    ):
+        raise RuntimeError("installed GitHub journey did not complete")
+    if (
+        replayed.kind != "replayed"
+        or replayed.credential_requests != 0
+        or replayed.mutations != 0
+    ):
+        raise RuntimeError("installed GitHub replay was not bounded")
+
     calls = 0
 
     async def publish_report(arguments, context):